CN110278207B - Click hijacking vulnerability detection method and device and computer equipment - Google Patents

Abstract

The invention discloses a click hijacking vulnerability detection method, a device and computer equipment, wherein the method comprises the following steps: acquiring a Uniform Resource Locator (URL) of a page to be detected, and determining whether to execute a simulated click operation on the page to be detected according to the URL; if the simulated click operation is determined to be executed on the page to be detected, acquiring a hypertext transfer protocol (HTTP) response message returned based on the simulated click operation; determining whether the page to be detected has a click hijack vulnerability or not according to at least one item of result in the HTTP response message; the at least one item of result comprises whether the HTTP response message contains a page nesting attribute of the content security policy CSP or not, or whether the HTTP response message contains a preset anti-hijacking code for prohibiting the page to be detected from loading the iframe page.

Description

A clickjacking vulnerability detection method, device and computer equipment

technical field

The present invention relates to the field of financial technology (Fintech) and the field of information security, in particular to a clickjacking vulnerability detection method, device and computer equipment.

Background technique

With the development of computer technology, more and more technologies (big data, distributed, blockchain (Blockchain), artificial intelligence, etc.) are applied in the financial field, and the traditional financial industry is gradually transforming into financial technology (Fintech). At present, in the field of financial technology, information security is very important. Clickjacking is a visual deception method. An attacker can use a transparent and invisible inline frame (iframe) to overlay a web page, and then lure To make the user operate on the webpage, by adjusting the position of the iframe page, the user can be induced to click on some functional buttons and perform some operations on the iframe page. Therefore, there are click-jacking vulnerabilities on some web pages, and these click-jacking vulnerabilities need to be detected.

At present, the way to detect clickjacking vulnerabilities is to manually test webpages. By manually clicking on webpages, the test will click on some functional buttons on the iframe page to determine whether a page has clickjacking vulnerabilities. However, under the manual detection method, it is difficult to distinguish whether the click is on some functional buttons on the iframe page or on the page to be detected. lower.

Contents of the invention

The embodiment of the present application provides a clickjacking vulnerability detection method, device and computer equipment, which solves the problems in the prior art that omissions or false positives are easy to occur when detecting clickjacking vulnerabilities, and the detection accuracy is low.

In the first aspect, the embodiment of the present application provides a clickjacking vulnerability detection method: obtain the Uniform Resource Locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL; The page to be detected performs a simulated click operation, then obtains the hypertext transfer protocol HTTP response message returned based on the simulated click operation; determines whether there is a click on the page to be detected according to at least one result in the HTTP response message Hijacking vulnerability; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains an inline box for prohibiting the loading of the page to be detected The default anti-hijacking code for iframe pages.

In the above method, first obtain the uniform resource locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL, if it is determined to perform a simulated click operation on the page to be detected, then obtain HTTP Response message, and determine whether there is a click-hijacking vulnerability according to at least one result in the HTTP response message; thereby reducing a part of false negatives of the click-hijacking vulnerability according to the URL, and in addition, click on the page to be detected When hijacking a vulnerability, determine whether there is a click hijacking vulnerability on the page to be detected by performing at least one result of a simulated click operation on the page to be detected, and the page nesting attribute of the CSP represents whether the page to be detected can be blocked by an iframe page Nesting, combined with the preset anti-hijacking code used to prohibit the page to be detected from loading the iframe page, comprehensively considers whether there is a click hijacking vulnerability on the page to be detected, thereby improving the detection accuracy.

In an optional implementation manner, the HTTP response message includes an HTTP resource part, and it is determined whether the HTTP response message contains the preset anti-hijacking code in the following manner: combine the HTTP resource part with a preset regular expression Regular matching is performed according to the regular matching result, and whether the HTTP response message contains the preset anti-hijacking code is determined according to the regular matching result.

In the above method, it is determined whether the HTTP response message contains the preset anti-hijacking code through the result of regular matching of the HTTP resource part and the preset regular expression, because the regular expression has strong logic and flexibility Therefore, it can be accurately checked whether the preset anti-hijacking code is contained.

In an optional implementation manner, if it is determined to perform a simulated click operation on the page to be detected, obtaining a Hypertext Transfer Protocol HTTP response message returned based on the simulated click operation includes: if the simulated click operation The corresponding HTTP request is a request for changing the background data of the page to be detected, and the HTTP request contains login status information, then the HTTP response message returned based on the simulated click operation is obtained.

In the above method, since the HTTP request is a request to change the background data of the page to be detected, and the HTTP request contains login state information, the HTTP request has the condition of hijacking vulnerability, so in this case, the HTTP response message.

In an optional implementation manner, the determining whether to perform a simulated click operation on the page to be detected according to the URL includes: determining whether the URL is in a preset URL whitelist, and if not, performing an operation on the page to be detected The detection page performs a simulated click action.

In the above method, some URLs are filtered out in advance by presetting the URL whitelist, thereby preventing false positives to a certain extent and improving the detection accuracy of clickjacking vulnerabilities.

In an optional implementation manner, the at least one result further includes: whether the HTTP response message includes page nesting header information.

In the above method, another result of detecting the clickjacking vulnerability is extended, and the page nesting header information represents the page nesting attribute of the page to be detected, which further improves the detection accuracy of the clickjacking vulnerability.

In a second aspect, the present application provides a clickjacking vulnerability detection device, including: an acquisition module, configured to acquire the Uniform Resource Locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL A processing module, configured to obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation if it is determined to perform a simulated click operation on the page to be detected; according to at least one item in the HTTP response message As a result, it is determined whether there is a click-hijacking vulnerability in the page to be detected; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains the The preset anti-hijacking code of the inline box iframe page is prohibited from being loaded by the page to be detected.

In an optional implementation manner, the HTTP response message includes an HTTP resource part, and the processing module is specifically configured to: determine whether the HTTP response message contains the preset anti-hijacking code in the following manner: Perform regular matching on the HTTP resource part and the preset regular expression, and determine whether the HTTP response message contains the preset anti-hijacking code according to the result of the regular matching.

In an optional implementation manner, the processing module is specifically configured to: if the HTTP request corresponding to the simulated click operation is a request for changing the background data of the page to be detected, and the HTTP request contains login status information, Then acquire the HTTP response message returned based on the simulated click operation.

In an optional implementation manner, the processing module is specifically configured to: determine whether the URL is in the preset URL whitelist, and if not, perform a simulated click operation on the page to be detected.

In an optional implementation manner, the at least one result further includes: whether the HTTP response message includes page nesting header information.

For the above-mentioned second aspect and the beneficial effects of each embodiment of the second aspect, reference may be made to the above-mentioned first aspect and the beneficial effects of each embodiment of the first aspect, which will not be repeated here.

In a third aspect, an embodiment of the present application provides a computer device, including a program or an instruction, and when the program or instruction is executed, is used to execute the above-mentioned first aspect and the method in each embodiment of the first aspect.

In a fourth aspect, an embodiment of the present application provides a storage medium, including a program or an instruction, and when the program or instruction is executed, is used to execute the above-mentioned first aspect and the method in each embodiment of the first aspect.

Description of drawings

FIG. 1 is a schematic flow chart of a clickjacking vulnerability detection method provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of a preset anti-hijacking code of a clickjacking vulnerability detection method provided by an embodiment of the present application;

FIG. 3 is a schematic flow chart of specific steps of a clickjacking vulnerability detection method provided by an embodiment of the present application;

FIG. 4 is a schematic structural diagram of a clickjacking vulnerability detection device provided by an embodiment of the present application.

Detailed ways

In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application. To illustrate, rather than limit, the technical solutions of the present application, the embodiments of the present application and the technical features in the embodiments can be combined without conflict.

In the field of financial technology (Fintech), the importance of information security is self-evident. In the process of financial transactions, there are click-jacking vulnerabilities on some web pages, and these click-jacking vulnerabilities need to be detected. At present, the way to detect clickjacking vulnerabilities is to manually test webpages. By manually clicking on webpages, the test will click on some functional buttons on the iframe page to determine whether a page has clickjacking vulnerabilities. However, in the manual detection mode, it is difficult to distinguish whether the click is on some functional buttons on the iframe page or on the page to be detected, which is prone to false negatives or false positives, and the detection accuracy is low.

To this end, an embodiment of the present application provides a method for detecting a clickjacking vulnerability, and FIG. 1 is a schematic flowchart of steps of a method for detecting a clickjacking vulnerability provided in an embodiment of the present application.

Step 101: Acquiring the Uniform Resource Locator URL of the page to be detected, and determining whether to perform a simulated click operation on the page to be detected according to the URL.

It should be noted that the browser of the page to be detected here is not limited. For example, a headless browser (Headless Browser), a headless browser is a web browser without a graphical user interface (GUI), usually through programming or commands One of the many uses of Chrome Headless is to automate usability testing or test browser interaction. You can call ChromeHeadless to simulate click operations, etc.

Step 102: If it is determined to perform a simulated click operation on the page to be detected, obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation.

Step 103: Determine whether the page to be detected has a clickjacking vulnerability according to at least one result in the HTTP response message.

In step 101, the specific implementation manner of determining whether to perform a simulated click operation on the page to be detected according to the URL may be:

Determine whether the URL is in the preset URL whitelist, if not, perform a simulated click operation on the page to be detected.

For example, the preset URL whitelist includes URL1, URL2, and URL3. The URL4 of the page A to be detected is not in the preset URL whitelist, so a simulated click operation is performed on the page A to be detected.

In the above method, some URLs are filtered out in advance by presetting the URL whitelist, thereby preventing false positives to a certain extent and improving the detection accuracy of clickjacking vulnerabilities.

In step 102, if it is determined to perform a simulated click operation on the page to be detected, an optional implementation manner of obtaining a hypertext transfer protocol HTTP response message returned based on the simulated click operation is as follows:

If the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login state information, then obtain the HTTP response message returned based on the simulated click operation .

It should be noted that some related configuration information of the page to be detected is stored in the background server as background data, and the HTTP request refers to a request for changing the background data of the page to be detected.

In the above method, since the HTTP request is a request to change the background data of the page to be detected, and the HTTP request contains login state information, the HTTP request has the condition of hijacking vulnerability, so in this case, the HTTP response message.

In step 103, the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains an inline attribute for prohibiting the loading of the page to be detected. The preset anti-hijacking code of the frame iframe page.

The specific form of the preset anti-hijacking code is not limited here. For example, as shown in FIG. 2 , it is a schematic diagram of a preset anti-hijacking code of a clickjacking vulnerability detection method provided by an embodiment of the present application. The code shown in Figure 2 performs the following steps at runtime:

The first step is to set the display of the main part of the page to be detected to be a cascading style sheet (cascading style sheets, CSS) style of None.

It should be noted that display is a parameter that can define CSS styles, and different CSS styles can be set by assigning different values to display. When display is set to None, the main part displayed on the page to be detected will not be hidden on the page to be detected by the browser, and will not be controlled by clicking. According to the rendering order of the code by the browser, the style tag of the main body will be hidden. The code of will take effect first, and style is an attribute of the page to be detected.

In the second step, when the browser renders to the final js code part, the js code in the script tag takes effect, and checks whether the page is nested.

It should be noted that js is a literal scripting language of JavaScript.

Step 3: If top and self are equal, it means that the page is not nested, then remove the CSS style that originally set display to None in the main body.

Among them, top is a variable provided by the browser, representing the outermost window object, and self is the current window object.

The fourth step, if top and self are not equal, then assign self.location to top.location, so that the js code will jump the page of the outermost window to the page of the page to be detected to prevent nesting.

Among them, top.location indicates the location of the outermost window object, and self.location indicates the location of the current window object.

The HTTP response message includes an HTTP resource part, and it is determined whether the HTTP response message contains the preset anti-hijacking code in the following manner: the HTTP resource part is regularly matched with a preset regular expression, and according to the regular match As a result of determining whether the HTTP response message contains the preset anti-hijacking code.

In the above method, it is determined whether the HTTP response message contains the preset anti-hijacking code through the result of regular matching of the HTTP resource part and the preset regular expression, because the regular expression has strong logic and flexibility Therefore, it can be accurately checked whether the preset anti-hijacking code is contained.

In addition, the HTTP response message includes an HTTP header, and it can be determined through string matching whether it contains the page nesting attribute of the content security policy CSP.

It should be noted that when the page nesting attribute of CSP takes different values, it represents different attributes. For example: (1) CSP:frame-ancestors'none' means that it cannot be nested; (2)CSP:frame-ancestors 'self'; can only be nested by this site; (3) CSP:frame-ancestors'self'*.somesite.com'; where *.somesite.com can indicate the Domain Name Protocol port of the nested site, etc. information.

It should be noted that the above at least one result may also include: whether the HTTP response message includes page nesting header information. In the above method, another result of detecting clickjacking vulnerabilities is extended. The page nesting header information represents the page nesting attributes of the page to be detected, which further improves the detection accuracy of clickjacking vulnerabilities. String matching can also be used to Determine whether to contain page nesting header information. For example, the page nesting header information may be the X-Frame-Options header.

Specifically, when X-Frame-Options takes different values, the results are as follows: X-Frame-Options: DENY: Nesting is not allowed; X-Frame-Options: SAMEORIGIN: Can be nested by same-origin sites; X-Frame -Options:ALLOW-FROM uri; specify pages that can be nested. Since the page nesting header information of X-Frame-Options is not currently supported by some browsers, in some cases it is necessary to combine the page nesting attributes of CSP to determine the clickjacking vulnerability.

In the method described in steps 101 to 103, first obtain the Uniform Resource Locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL, if it is determined to perform a click operation on the page to be detected Simulate a click operation, then obtain the HTTP response message, and determine whether there is a click-hijacking vulnerability according to at least one result in the HTTP response message; thereby reducing a part of the click-hijacking vulnerability according to the URL. When the page to be detected has a click hijacking vulnerability, it is determined whether the page to be detected has a click hijacking vulnerability by performing at least one result of a simulated click operation on the page to be detected, and the page nesting attribute of the CSP represents the Detecting whether the page can be nested by an iframe page, combined with the preset anti-hijacking code used to prohibit the page to be detected from loading the inline box iframe page, fully considers whether the page to be detected has a click hijacking vulnerability, thereby improving detection Accuracy.

A method for detecting a clickjacking vulnerability provided by an embodiment of the present application is described in detail below in conjunction with FIG. 3 . FIG. 3 is a schematic flowchart of specific steps of the method.

Step 301: Obtain the URL of the page to be detected.

Step 302: Determine whether the URL of the page to be detected is in the preset white list.

If yes, go to step 310; otherwise, go to step 303.

Step 303: Perform a simulated click operation to trigger an HTTP request.

For example, calling Chrome Headless JavaScript to simulate a click.

Step 304: Determine whether the HTTP request satisfies a preset condition: the HTTP request is a request for updating the background data of the page to be detected, and the HTTP request includes login status information.

If yes, go to step 305; otherwise, go to step 310.

Step 305: Obtain an HTTP response message.

The HTTP response message is a response message in response to the HTTP request of the page to be detected.

After step 305 is executed, at least one of steps 306 to 308 is executed.

Step 306: Determine whether the HTTP response message contains page nesting header information.

Step 307: Determine whether the HTTP response message contains the page nesting attribute of the CSP policy.

Step 308: Determine whether the HTTP response message contains a preset anti-hijacking code.

It should be noted that at least one of steps 306 to 308 may be executed at the same time, and steps 306 to 308 are not affected.

If the determination result of at least one of the steps executed in steps 306 to 308 is yes, then step 310 is executed; otherwise, step 309 is executed.

Step 309: Determine that the page to be detected has a clickjacking vulnerability.

Step 310: Determine that the page to be detected has no clickjacking vulnerability.

Determine whether the page to be detected has a clickjacking vulnerability according to at least one result in the HTTP response message; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, Or, whether the HTTP response message contains a preset anti-hijacking code for prohibiting the page to be detected from loading an iframe page.

Compare the prior art and the method in this application to test the homepages of 200 domain names, and the results are shown in Table 1:

Total detection Detected number Number of missing reports Number of false positives current technology 200 115 12 33 this application 200 91 7 4

Table 1

It can be found that the accuracy rate of this application method is greatly improved, and the false positive rate is relatively greatly reduced. The above-mentioned false positives and false positives can be improved by setting a black and white list, reducing the manual review time of security personnel.

As shown in FIG. 4 , it is a schematic structural diagram of a clickjacking vulnerability detection device provided by the embodiment of the present application.

The present application provides a clickjacking vulnerability detection device, comprising: an acquisition module 401, configured to acquire the Uniform Resource Locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL; a processing module 402. If it is determined to perform a simulated click operation on the page to be detected, obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation; determine according to at least one result in the HTTP response message Whether there is a click hijacking vulnerability in the page to be detected; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains a Describe the preset anti-hijacking code of the iframe page loaded by the page to be detected.

In an optional implementation manner, the HTTP response message includes an HTTP resource part, and the processing module 402 is specifically configured to: determine whether the HTTP response message contains the preset anti-hijacking code in the following manner: The HTTP resource part is regularly matched with a preset regular expression, and it is determined whether the HTTP response message contains the preset anti-hijacking code according to the result of the regular match.

In an optional implementation manner, the processing module 402 is specifically configured to: if the HTTP request corresponding to the simulated click operation is a request for changing the background data of the page to be detected, and the HTTP request contains login status information , then acquire the HTTP response message returned based on the simulated click operation.

In an optional implementation manner, the processing module 402 is specifically configured to: determine whether the URL is in the preset URL whitelist, and if not, perform a simulated click operation on the page to be detected.

In an optional implementation manner, the at least one result further includes: whether the HTTP response message includes page nesting header information.

For the beneficial effects of the various embodiments of the above-mentioned device, reference may be made to the beneficial effects of a clickjacking vulnerability method provided in the present application, which will not be repeated here.

An embodiment of the present application provides a computer device, including a program or an instruction, and when the program or instruction is executed, it is used to execute a clickjacking vulnerability method provided in the present application and the methods of various embodiments.

An embodiment of the present application provides a storage medium, including a program or an instruction. When the program or instruction is executed, it is used to execute a clickjacking vulnerability method provided in the present application and the methods in various embodiments.

Finally, it should be noted that: those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

Apparently, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (12)

1. A clickjacking vulnerability detection method, characterized in that, comprising: Obtaining the Uniform Resource Locator URL of the page to be detected, and determining whether to perform a simulated click operation on the page to be detected according to the URL; If it is determined to perform a simulated click operation on the page to be detected, then obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation; Determine whether the page to be detected has a clickjacking vulnerability according to at least one result in the HTTP response message; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, Or, whether the HTTP response message contains a preset anti-hijacking code for prohibiting the page to be detected from loading an iframe page; The value of the page nesting attribute of the CSP indicates any of the following attributes: indicating that the page to be detected cannot be nested; indicating that the page to be detected can only be nested by this site; indicating that the page to be detected A site where pages can be nested. 2. The method according to claim 1, wherein the HTTP response message includes an HTTP resource part, and it is determined whether the HTTP response message contains the preset anti-hijacking code in the following manner: Regularly matching the HTTP resource part with a preset regular expression, and determining whether the HTTP response message contains the preset anti-hijacking code according to a result of the regular matching. 3. The method according to claim 1, wherein if it is determined to perform a simulated click operation on the page to be detected, then obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation, including : If the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login state information, then obtain the HTTP response message returned based on the simulated click operation . 4. The method according to claim 1, wherein determining whether to perform a simulated click operation on the page to be detected according to the URL comprises: Determine whether the URL is in the preset URL whitelist, if not, perform a simulated click operation on the page to be detected. 5. The method according to any one of claims 1-4, wherein the at least one result further comprises: whether the HTTP response message includes page nesting header information. 6. A clickjacking vulnerability detection device, characterized in that it comprises: An acquisition module, configured to acquire the Uniform Resource Locator URL of the page to be detected, and determine whether to perform a simulated click operation on the page to be detected according to the URL; A processing module, configured to obtain a hypertext transfer protocol HTTP response message returned based on the simulated click operation if it is determined to perform a simulated click operation on the page to be detected; according to at least one result in the HTTP response message Determine whether there is a clickjacking vulnerability in the page to be detected; the at least one result includes whether the HTTP response message contains the page nesting attribute of the content security policy CSP, or whether the HTTP response message contains The page to be detected loads the preset anti-hijacking code of the inline box iframe page; The value of the page nesting attribute of the CSP indicates any of the following attributes: indicating that the page to be detected cannot be nested; indicating that the page to be detected can only be nested by this site; indicating that the page to be detected A site where pages can be nested. 7. The device according to claim 6, wherein the HTTP response message includes an HTTP resource part, and the processing module is specifically used for: Determine whether the HTTP response message contains the preset anti-hijacking code in the following manner: Regularly matching the HTTP resource part with a preset regular expression, and determining whether the HTTP response message contains the preset anti-hijacking code according to a result of the regular matching. 8. The device according to claim 6, wherein the processing module is specifically used for: If the HTTP request corresponding to the simulated click operation is a request to change the background data of the page to be detected, and the HTTP request contains login state information, then obtain the HTTP response message returned based on the simulated click operation . 9. The device according to claim 6, wherein the processing module is specifically used for: Determine whether the URL is in the preset URL whitelist, if not, perform a simulated click operation on the page to be detected. 10. The device according to any one of claims 6-9, wherein the at least one result further includes: whether the HTTP response message includes page nesting header information. 11. A computer device, characterized in that the computer device comprises: a processor and a memory; wherein the memory stores a program or an instruction, and when the program or instruction is executed by the processor, the The computer device executes the method according to any one of claims 1 to 5. 12. A storage medium, characterized in that the storage medium comprises computer instructions, and when the computer instructions are run on a computer, the computer is made to execute the method according to any one of claims 1 to 5.

Images